OSCAL Plan of Action and Milestones (POA&M)
1.1.2Schema URL
Properties
Definitions
A URI Reference, either a URI or a relative-reference, formatted according to section 4.1 of RFC3986.
A plan of action and milestones which identifies initial and residual risks, deviations, and disposition, such as those required by FedRAMP.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
Allows components, and inventory-items to be defined within the POA&M for circumstances where no OSCAL-based SSP exists, or is not delivered with the POA&M.
Describes an individual POA&M item.
The title or name for this POA&M item .
A human-readable description of POA&M item.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
Provides information about the containing document, and defines concepts that are shared across the document.
A name given to the document, which may be used by a tool for display and navigation.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A collection of resources that may be referenced from within the OSCAL document instance.
An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A universal resource identifier (URI) formatted according to RFC3986.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A reference to a local or remote resource, that has a specific relation to the containing object.
A URI Reference, either a URI or a relative-reference, formatted according to section 4.1 of RFC3986.
Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A textual label to associate with the link, which may be used for presentation in a tool.
A reference to a set of persons and/or organizations that have responsibility for performing the referenced role in the context of the containing object.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
An action applied by a role within a given party to the content.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A universal resource identifier (URI) formatted according to RFC3986.
A string representing a point in time with a required timezone.
A reference to a role with responsibility for performing a function relative to the containing object, optionally associated with a set of persons and/or organizations that perform that role.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A representation of a cryptographic digest generated over a resource using a specified hash algorithm.
The digest method by which a hash is derived.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
Additional commentary about the containing object.
A string representing a point in time with a required timezone.
A string representing a point in time with a required timezone.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
An email address string formatted according to RFC 6531.
A telephone service number as defined by ITU-T E.164.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
Indicates the type of phone number.
A postal address for the location.
Indicates the type of address.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A document identifier qualified by an identifier scheme.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.
A defined component that can be part of an implemented system.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A category describing the purpose of the component.
A human readable name for the system component.
A description of the component, including information about its function.
Describes the operational status of the system component.
2 nested properties
A summary of the technological or business purpose of the component.
Information about the protocol used to provide a service.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A human readable name for the protocol (e.g., Transport Layer Security).
Where applicable this is the IPv4 port range on which the service operates.
Indicates the degree to which the a given control is implemented.
Identifies the implementation status of the control or control objective.
A type of user that interacts with the system based on an associated role.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A name given to the user, which may be used by a tool for display and navigation.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A summary of the user's purpose within the system.
Identifies a specific system privilege held by the user, along with an associated description and/or rationale for the privilege.
A human readable name for the privilege.
A summary of the privilege's purpose within the system.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A single managed inventory item within the system.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A summary of the inventory item stating its purpose within the system.
Identifies the parameter that will be set by the enclosed value.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A human-oriented, globally unique identifier with cross-instance scope that can be used to reference this system identification property elsewhere in this or other OSCAL instances. When referencing an externally defined system identification, the system identification must be used in the context of the external / imported OSCAL instance (e.g., uri-reference). This string should be assigned per-subject, which means it should be consistently used to identify the same system across revisions of the document.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
Identifies the identification system from which the provided identifier was assigned.
An annotated, markup-based textual element of a control's or catalog group's definition, or a child of another part.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A universal resource identifier (URI) formatted according to RFC3986.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
An optional name given to the part, which may be used by a tool for display and navigation.
Permits multiple paragraphs, lists, tables etc.
Parameters provide a mechanism for the dynamic assignment of value(s) in a control.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A short, placeholder name for the parameter, which can be used as a substitute for a value if no value is assigned.
Describes the purpose and use of a parameter.
A formal or informal expression of a constraint or test.
A textual summary of the constraint to be applied.
A prose statement that provides a recommendation for the use of a parameter.
Prose permits multiple paragraphs, lists, tables etc.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
Presenting a choice among alternatives.
Describes the number of selections that must occur. Without this setting, only one value should be assumed to be permitted.
Include all controls from the imported catalog or profile resources.
Used by the assessment plan and POA&M to import information about the system.
A URI Reference, either a URI or a relative-reference, formatted according to section 4.1 of RFC3986.
A local definition of a control objective for this assessment. Uses catalog syntax for control objective and assessment actions.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A human-readable description of this control objective.
A local definition of a control objective. Uses catalog syntax for control objective and assessment activities.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A human-readable description of this assessment method.
Identifies an assessment or related process that can be performed. In the assessment plan, this is an intended activity which may be associated with an assessment task. In the assessment results, this an activity that was actually performed as part of an assessment.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A human-readable description of this included activity.
The title for this included activity.
Represents a scheduled event or milestone, which may be associated with a series of assessment actions.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
The type of task.
The title for this task.
A human-readable description of this task.
The timing under which the task is intended to occur.
3 nested properties
The task is intended to occur on the specified date.
1 nested properties
A string representing a point in time with a required timezone.
The task is intended to occur within the specified date range.
2 nested properties
A string representing a point in time with a required timezone.
A string representing a point in time with a required timezone.
The task is intended to occur at the specified frequency.
2 nested properties
Identifies the controls being assessed and their control objectives.
A human-readable description of control objectives.
Used to select a control for inclusion/exclusion based on one or more control identifiers. A set of statement identifiers can be used to target the inclusion/exclusion to only specific control statements providing more granularity over the specific statements that are within the asessment scope.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
Used to select a control objective for inclusion/exclusion based on the control objective's identifier.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
Used when the assessment subjects will be determined as part of one or more other assessment activities. These assessment subjects will be recorded in the assessment results in the assessment log.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A human-readable description of intent of this assessment subject placeholder.
Identifies system elements being assessed, such as components, inventory items, and locations. In the assessment plan, this identifies a planned assessment subject. In the assessment results this is an actual assessment subject, and reflects any changes from the plan. exactly what will be the focus of this assessment. Any subjects not identified in this way are out-of-scope.
Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.
A human-readable description of the collection of subjects being included in this assessment.
Identifies a set of assessment subjects to include/exclude by UUID.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
Used to indicate the type of object pointed to by the uuid-ref within a subject.
A human-oriented identifier reference to a resource. Use type to indicate whether the identified resource is a component, inventory item, location, user, or something else.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
Used to indicate the type of object pointed to by the uuid-ref within a subject.
The title or name for the referenced subject.
Identifies the assets used to perform this assessment, such as the assessment team, scanning tools, and assumptions.
Captures an assessor's conclusions regarding the degree to which an objective is satisfied.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A determination of if the objective is satisfied or not within a given system.
3 nested properties
An indication as to whether the objective is satisfied or not.
The reason the objective was given it's status.
The title for this objective status.
A human-readable description of the assessor's conclusions regarding the degree to which an objective is satisfied.
Describes an individual finding.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
The title for this finding.
A human-readable description of this finding.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
Describes an individual observation.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A human-readable description of this assessment observation.
A string representing a point in time with a required timezone.
The title for this observation.
A string representing a point in time with a required timezone.
Identifies the source of the finding, such as a tool, interviewed person, or activity.
The actor that produces an observation, a finding, or a risk. One or more actor type can be used to specify a person that is using a tool.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A pointer, by ID, to an externally-defined threat.
Specifies the source of the threat information.
A universal resource identifier (URI) formatted according to RFC3986.
A URI Reference, either a URI or a relative-reference, formatted according to section 4.1 of RFC3986.
An identified risk.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
The title for this risk.
A human-readable summary of the identified risk, to include a statement of how the risk impacts the system.
An summary of impact for how the risk affects the system.
A string representing a point in time with a required timezone.
A log of all risk-related tasks taken.
1 nested properties
Used to indicate who created a log entry in what role.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
Describes the status of the associated risk.
A collection of descriptive data about the containing object from a specific origin.
Describes either recommended or an actual plan for addressing the risk.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
Identifies whether this is a recommendation, such as from an assessor or tool, or an actual plan accepted by the system owner.
The title for this response activity.
A human-readable description of this response plan.
A partition of an assessment plan or results or a child of another part.
A textual label that uniquely identifies the part's semantic type.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.
A universal resource identifier (URI) formatted according to RFC3986.
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A name given to the part, which may be used by a tool for display and navigation.
Permits multiple paragraphs, lists, tables etc.
Binary data encoded using the Base 64 encoding algorithm as defined by RFC4648.
A string representing a point in time with a required timezone.
An email address string formatted according to RFC 6531.
A whole number value.
An integer value that is equal to or greater than 0.
An integer value that is greater than 0.
A non-empty string with leading and trailing whitespace disallowed. Whitespace is: U+9, U+10, U+32 or [ ]+
A non-colonized name as defined by XML Schema Part 2: Datatypes Second Edition. https://www.w3.org/TR/xmlschema11-2/#NCName.
A universal resource identifier (URI) formatted according to RFC3986.
A URI Reference, either a URI or a relative-reference, formatted according to section 4.1 of RFC3986.
A type 4 ('random' or 'pseudorandom') or type 5 UUID per RFC 4122.